VDB
RHSA-2025%3A4511
RHSA-2025%3A4511
PUBLISHED
CVSS 5.400000095367432 MEDIUM
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
Risk Scores
CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | odf4/ocs-client-rhel9-operator@sha256:e30d8117f60ed99c40321cf776f5c5ef2c8f2b0c4623100886e4dacada78ef8b_ppc64le as a component of RHODF 4.18 for RHEL 9 | odf4/ocs-client-rhel9-operator@sha256:e30d8117f60ed99c40321cf776f5c5ef2c8f2b0c4623100886e4dacada78ef8b_ppc64le, odf4/ocs-client-rhel9-operator@sha256:e30d8117f60ed99c40321cf776f5c5ef2c8f2b0c4623100886e4dacada78ef8b_ppc64le, odf4/ocs-client-rhel9-operator@sha256:e30d8117f60ed99c40321cf776f5c5ef2c8f2b0c4623100886e4dacada78ef8b_ppc64le |
| Red Hat | odf4/mcg-operator-bundle@sha256:f7981eb58f8f965e1eef8fef50bf58e6fbf92c54fc5c376d34adeff39427db68_amd64 as a component of RHODF 4.18 for RHEL 9 | odf4/mcg-operator-bundle@sha256:f7981eb58f8f965e1eef8fef50bf58e6fbf92c54fc5c376d34adeff39427db68_amd64, odf4/mcg-operator-bundle@sha256:f7981eb58f8f965e1eef8fef50bf58e6fbf92c54fc5c376d34adeff39427db68_amd64, odf4/mcg-operator-bundle@sha256:f7981eb58f8f965e1eef8fef50bf58e6fbf92c54fc5c376d34adeff39427db68_amd64 |
| Red Hat | odf4/cephcsi-rhel9@sha256:5bce68f3ecb18da15dd044ef9d83cc3be06ff4d35f0d8958e166197dc300b5a7_ppc64le as a component of RHODF 4.18 for RHEL 9 | odf4/cephcsi-rhel9@sha256:5bce68f3ecb18da15dd044ef9d83cc3be06ff4d35f0d8958e166197dc300b5a7_ppc64le, odf4/cephcsi-rhel9@sha256:5bce68f3ecb18da15dd044ef9d83cc3be06ff4d35f0d8958e166197dc300b5a7_ppc64le, odf4/cephcsi-rhel9@sha256:5bce68f3ecb18da15dd044ef9d83cc3be06ff4d35f0d8958e166197dc300b5a7_ppc64le |
| Red Hat | odf4/ocs-client-rhel9-operator@sha256:dc4db8e33107450531de8c9bd1ce22bddccbb6bead8fe784f8bed7107ec32733_arm64 as a component of RHODF 4.18 for RHEL 9 | *, odf4/ocs-client-rhel9-operator@sha256:dc4db8e33107450531de8c9bd1ce22bddccbb6bead8fe784f8bed7107ec32733_arm64, odf4/ocs-client-rhel9-operator@sha256:dc4db8e33107450531de8c9bd1ce22bddccbb6bead8fe784f8bed7107ec32733_arm64 |
| Red Hat | odf4/ocs-client-console-rhel9@sha256:00e88ad3e5d29ac067163e93cb1ee716e8bf63bf90cd2ff09020a217d055db28_amd64 as a component of RHODF 4.18 for RHEL 9 | *, *, * |
| Red Hat | odf4/odf-must-gather-rhel9@sha256:0971755b68260e73ac938ac22494d8002fa08d31fea54b9fa7abeee802bbe161_arm64 as a component of RHODF 4.18 for RHEL 9 | odf4/odf-must-gather-rhel9@sha256:0971755b68260e73ac938ac22494d8002fa08d31fea54b9fa7abeee802bbe161_arm64, odf4/odf-must-gather-rhel9@sha256:0971755b68260e73ac938ac22494d8002fa08d31fea54b9fa7abeee802bbe161_arm64, odf4/odf-must-gather-rhel9@sha256:0971755b68260e73ac938ac22494d8002fa08d31fea54b9fa7abeee802bbe161_arm64 |
| Red Hat | odf4/odf-console-rhel9@sha256:49119045f93991b6631ba6b8e30d3aef3cd2ee54b15c42bdcf0dcb1f45ceda9e_amd64 as a component of RHODF 4.18 for RHEL 9 | odf4/odf-console-rhel9@sha256:49119045f93991b6631ba6b8e30d3aef3cd2ee54b15c42bdcf0dcb1f45ceda9e_amd64, odf4/odf-console-rhel9@sha256:49119045f93991b6631ba6b8e30d3aef3cd2ee54b15c42bdcf0dcb1f45ceda9e_amd64, * |
| Red Hat | odf4/ocs-metrics-exporter-rhel9@sha256:576db43dd6ea1ef3841b570c081ccef96cb451af94ec23200740bbae6ad3b618_amd64 as a component of RHODF 4.18 for RHEL 9 | odf4/ocs-metrics-exporter-rhel9@sha256:576db43dd6ea1ef3841b570c081ccef96cb451af94ec23200740bbae6ad3b618_amd64, odf4/ocs-metrics-exporter-rhel9@sha256:576db43dd6ea1ef3841b570c081ccef96cb451af94ec23200740bbae6ad3b618_amd64, odf4/ocs-metrics-exporter-rhel9@sha256:576db43dd6ea1ef3841b570c081ccef96cb451af94ec23200740bbae6ad3b618_amd64 |
| Red Hat | odf4/odf-must-gather-rhel9@sha256:63498d0a07d79df661e5e56ec1d8abce28e8a8d5e0c2368cf3af003e46cf5d8e_ppc64le as a component of RHODF 4.18 for RHEL 9 | odf4/odf-must-gather-rhel9@sha256:63498d0a07d79df661e5e56ec1d8abce28e8a8d5e0c2368cf3af003e46cf5d8e_ppc64le, odf4/odf-must-gather-rhel9@sha256:63498d0a07d79df661e5e56ec1d8abce28e8a8d5e0c2368cf3af003e46cf5d8e_ppc64le, * |
| Red Hat | odf4/odr-hub-operator-bundle@sha256:3d772e5d7ce539ee7e337fa78f0cdf166992776f878f4013854d3d14d891831e_amd64 as a component of RHODF 4.18 for RHEL 9 | *, odf4/odr-hub-operator-bundle@sha256:3d772e5d7ce539ee7e337fa78f0cdf166992776f878f4013854d3d14d891831e_amd64, odf4/odr-hub-operator-bundle@sha256:3d772e5d7ce539ee7e337fa78f0cdf166992776f878f4013854d3d14d891831e_amd64 |
| Red Hat | odf4/mcg-rhel9-operator@sha256:f1c7a74c9580a7d6725f1fef5aea3467e3bc6548c947e9804b9b9d6b9c56eb1e_amd64 as a component of RHODF 4.18 for RHEL 9 | *, odf4/mcg-rhel9-operator@sha256:f1c7a74c9580a7d6725f1fef5aea3467e3bc6548c947e9804b9b9d6b9c56eb1e_amd64, * |
| Red Hat | odf4/odr-hub-operator-bundle@sha256:3d772e5d7ce539ee7e337fa78f0cdf166992776f878f4013854d3d14d891831e_amd64 as a component of RHODF 4.18 for RHEL 9 | odf4/odr-hub-operator-bundle@sha256:3d772e5d7ce539ee7e337fa78f0cdf166992776f878f4013854d3d14d891831e_amd64, *, odf4/odr-hub-operator-bundle@sha256:3d772e5d7ce539ee7e337fa78f0cdf166992776f878f4013854d3d14d891831e_amd64 |
| Red Hat | odf4/ocs-client-operator-bundle@sha256:a7785285506015834c240a5cfd2416865d77d5bf261d6a8b9f5bc4431f22cb2c_amd64 as a component of RHODF 4.18 for RHEL 9 | *, odf4/ocs-client-operator-bundle@sha256:a7785285506015834c240a5cfd2416865d77d5bf261d6a8b9f5bc4431f22cb2c_amd64, * |
| Red Hat | odf4/odf-dependencies-operator-bundle@sha256:900fb1126749701bdb5a95b6e0336bcd580d6f880456bdd719a6fa1855db0e15_amd64 as a component of RHODF 4.18 for RHEL 9 | odf4/odf-dependencies-operator-bundle@sha256:900fb1126749701bdb5a95b6e0336bcd580d6f880456bdd719a6fa1855db0e15_amd64, odf4/odf-dependencies-operator-bundle@sha256:900fb1126749701bdb5a95b6e0336bcd580d6f880456bdd719a6fa1855db0e15_amd64, odf4/odf-dependencies-operator-bundle@sha256:900fb1126749701bdb5a95b6e0336bcd580d6f880456bdd719a6fa1855db0e15_amd64 |
| Red Hat | odf4/odf-csi-addons-sidecar-rhel9@sha256:10330c64a1b1bd0e8832d247c9842229187d4d4620d9d4e6286a780c5b512fad_arm64 as a component of RHODF 4.18 for RHEL 9 | odf4/odf-csi-addons-sidecar-rhel9@sha256:10330c64a1b1bd0e8832d247c9842229187d4d4620d9d4e6286a780c5b512fad_arm64, *, odf4/odf-csi-addons-sidecar-rhel9@sha256:10330c64a1b1bd0e8832d247c9842229187d4d4620d9d4e6286a780c5b512fad_arm64 |
| Red Hat | odf4/odr-hub-operator-bundle@sha256:791660be24a0f942996c47a21bed3ad12ae5caf30731461ee983ce79243e7648_s390x as a component of RHODF 4.18 for RHEL 9 | odf4/odr-hub-operator-bundle@sha256:791660be24a0f942996c47a21bed3ad12ae5caf30731461ee983ce79243e7648_s390x, *, * |
| Red Hat | odf4/odf-csi-addons-rhel9-operator@sha256:c1fc5c80766a8511b1bf27a872f65c1db187f62d429fb4d3a0e95fd319b31fbe_ppc64le as a component of RHODF 4.18 for RHEL 9 | *, *, * |
| Red Hat | odf4/odf-must-gather-rhel9@sha256:0971755b68260e73ac938ac22494d8002fa08d31fea54b9fa7abeee802bbe161_arm64 as a component of RHODF 4.18 for RHEL 9 | odf4/odf-must-gather-rhel9@sha256:0971755b68260e73ac938ac22494d8002fa08d31fea54b9fa7abeee802bbe161_arm64, odf4/odf-must-gather-rhel9@sha256:0971755b68260e73ac938ac22494d8002fa08d31fea54b9fa7abeee802bbe161_arm64, * |
| Red Hat | odf4/ocs-rhel9-operator@sha256:af338d2a0879003b97fc2445017f0cac90d4914e55806a533197d3b3d87367f0_s390x as a component of RHODF 4.18 for RHEL 9 | odf4/ocs-rhel9-operator@sha256:af338d2a0879003b97fc2445017f0cac90d4914e55806a533197d3b3d87367f0_s390x, odf4/ocs-rhel9-operator@sha256:af338d2a0879003b97fc2445017f0cac90d4914e55806a533197d3b3d87367f0_s390x, odf4/ocs-rhel9-operator@sha256:af338d2a0879003b97fc2445017f0cac90d4914e55806a533197d3b3d87367f0_s390x |
| Red Hat | odf4/ocs-rhel9-operator@sha256:e6f5e191147f1d053dc5c4add4dc0298bc3d6fd0ff6c76a8d7ad92449ddec84a_arm64 as a component of RHODF 4.18 for RHEL 9 | odf4/ocs-rhel9-operator@sha256:e6f5e191147f1d053dc5c4add4dc0298bc3d6fd0ff6c76a8d7ad92449ddec84a_arm64, odf4/ocs-rhel9-operator@sha256:e6f5e191147f1d053dc5c4add4dc0298bc3d6fd0ff6c76a8d7ad92449ddec84a_arm64, odf4/ocs-rhel9-operator@sha256:e6f5e191147f1d053dc5c4add4dc0298bc3d6fd0ff6c76a8d7ad92449ddec84a_arm64 |
…and 196 more
Timeline
- May 6, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:4511 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2290901 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2312579 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2319884 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2347423 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2348367 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://issues.redhat.com/browse/DFBUGS-1798 advisory
- https://issues.redhat.com/browse/DFBUGS-269 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4511.json advisory
- https://access.redhat.com/security/cve/CVE-2024-11831 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-11831 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-11831 advisory
- https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e advisory
- https://github.com/yahoo/serialize-javascript/pull/173 advisory
- https://access.redhat.com/security/cve/CVE-2024-21536 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-21536 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-21536 advisory
…and 37 more